[wide, labelwidth=!, labelindent=0pt]
Case 1: Successful detection. The PS will ignore all detected faulty machines and keep only the gradients from the remaining workers. Assume that \(h\)  workers \(U_{i_1}, U_{i_2}, \dots , U_{i_h}\)  have been identified as honest. For each of the \(f\)  files if there is at least one honest worker that processed it, the PS will pick one of the “honest” gradient values. The chosen gradients are then averaged for the update (cf. Eq. (REF )). For instance, in Figure REF , assume that \(U_1\) , \(U_2\)  and \(U_4\)  have been identified as faulty. During aggregation, the PS will ignore the red file as all 3 copies have been compromised. For the orange file, it will pick either the gradient computed by \(U_5\)  or \(U_6\)  as both of them are honest values.

Case 2: Unsuccessful detection. During aggregation, the PS will perform a majority vote across the computations of each file. Recall that each file has been processed by \(r\)  workers. For each such file \(B_{t,i}\) , the PS decides a majority value \(\mathbf {m}_i\)
\(\mathbf {m}_i := \mathrm {majority}\left\lbrace \hat{\mathbf {g}}_{t,i}^{(j)}: U_j \in \mathcal {N}(B_{t,i})\right\rbrace .\) 
Assume that \(r\)  is odd and let \(r^{\prime }=\frac{r+1}{2}\) . Under the rule in Eq. (REF ), the gradient on a file is distorted only if at least \(r^{\prime }\)  of the computations are performed by Byzantines. Following the majority vote, we will further filter the gradients coordinate-wise median and will be referring to the combination of these two steps as robust aggregation; a similar setup was considered in [1]}, [2]}. For example, in Figure REF , all returned values for the red file will be evaluated by a majority vote function on the PS which decides a single output value; a similar voting is done for the other 3 files. After the voting process, Aspis applies coordinate-wise median on the “winning” gradients \(\mathbf {m}_i\) , \(i=0,1,\dots ,f-1\) .

